Security fixes are made on main and released from the current 0.x line. Upgrade to the latest published version before reporting behavior that may already be fixed.

Private vulnerability reporting is not currently enabled for this repository. Open a minimal public issue asking the maintainer to establish a private contact channel; do not include vulnerability details, paths, skill contents, credentials, or personal data in that issue.

Once a private channel is established, include the affected version, operating system, agent-skill source, impact, and a minimal reproduction that contains no real credentials, personal data, or private skill content. You should receive an acknowledgement within seven days. No response-time or disclosure deadline is guaranteed for this volunteer-maintained project.

Skillview is a local inspector, not a skill sandbox or malware scanner. It reads skill Markdown and file names but does not execute skill scripts. The packaged server binds to 127.0.0.1, rejects cross-origin browser requests, and authorizes actions against a freshly rediscovered server-side record. Linked, plugin, cache, and marketplace records are inspection-only.

Only run Skillview on a machine and workspace whose local files you are authorized to inspect. Review any skill independently before allowing an agent to execute its instructions or scripts.